CVE-2026-18996
Received Received - Intake

Incorrect Privilege Assignment in Mercury Agent

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description
A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component run_command Handler. Such manipulation leads to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-18996
EUVD
EUVD-2026-53709

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cosmicstack-labs mercury-agent to 1.1.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in cosmicstack-labs mercury-agent versions up to 1.1.12. It is located in the PermissionManager.checkShellCommand function within src/capabilities/permissions.ts. The flaw allows incorrect privilege assignment due to improper handling of shell commands, potentially enabling unauthorized actions.

Detection Guidance

The provided CVE data does not include specific detection methods or commands. Manual review of the function PermissionManager.checkShellCommand in src/capabilities/permissions.ts for improper privilege assignments may be required.

Impact Analysis

An attacker could exploit this remotely to gain elevated privileges or execute unauthorized commands on the affected system. This may lead to data breaches, system compromise, or unauthorized access to sensitive resources depending on the application's context.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, which is a key concern for GDPR and HIPAA. Organizations may face penalties if this flaw leads to data exposure or unauthorized processing of personal health information.

Mitigation Strategies

Immediate steps include updating cosmicstack-labs mercury-agent to a version beyond 1.1.12 if available, restricting remote access to the vulnerable function, and monitoring for unusual privilege escalation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart